Skip to content

Commit

Permalink
adapt test for TLS_SHA{256,384}_SHA{256,384}
Browse files Browse the repository at this point in the history 
ciphername_test.c: add integrity-only cipher name

sslapitest.c, ssltestlib.h: update test for integrity-only cipher

quicapitest.c: add TLS_SHA{256,384}_SHA{256,384} to non quic ciphersuites
  • Loading branch information
@rajeev-0
rajeev-0 committed Dec 13, 2023
1 parent 74509c6 commit ad6ce15
Show file tree
Hide file tree
Showing 5 changed files with 64 additions and 17 deletions.
2 changes: 2 additions & 0 deletions test/ciphername_test.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -361,6 +361,8 @@ static CIPHER_ID_NAME cipher_names[] = {
{0x1303, "TLS_CHACHA20_POLY1305_SHA256"},
{0x1304, "TLS_AES_128_CCM_SHA256"},
{0x1305, "TLS_AES_128_CCM_8_SHA256"},
{0xC0B4, "TLS_SHA256_SHA256"},
{0xC0B5, "TLS_SHA384_SHA384"},
{0xFEFE, "SSL_RSA_FIPS_WITH_DES_CBC_SHA"},
{0xFEFF, "SSL_RSA_FIPS_WITH_3DES_EDE_CBC_SHA"},
};
Expand Down
12 changes: 10 additions & 2 deletions test/evp_libctx_test.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -334,7 +334,11 @@ static int test_cipher_reinit(int test_id)
0x03, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
};
unsigned char iv[16] = {
unsigned char iv[48] = {
0x0f, 0x0e, 0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08,
0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00,
0x0f, 0x0e, 0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08,
0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00,
0x0f, 0x0e, 0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08,
0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00
};
Expand Down Expand Up @@ -425,7 +429,11 @@ static int test_cipher_reinit_partialupdate(int test_id)
0x03, 0x01, 0x02, 0x03, 0x04, 0x05, 0x06, 0x07,
0x08, 0x09, 0x0a, 0x0b, 0x0c, 0x0d, 0x0e, 0x0f,
};
static const unsigned char iv[16] = {
static const unsigned char iv[48] = {
0x0f, 0x0e, 0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08,
0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00,
0x0f, 0x0e, 0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08,
0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00,
0x0f, 0x0e, 0x0d, 0x0c, 0x0b, 0x0a, 0x09, 0x08,
0x07, 0x06, 0x05, 0x04, 0x03, 0x02, 0x01, 0x00
};
Expand Down
2 changes: 2 additions & 0 deletions test/helpers/ssltestlib.h
View file
Original file line number Diff line number Diff line change
Expand Up @@ -17,6 +17,8 @@
#define TLS13_CHACHA20_POLY1305_SHA256_BYTES ((const unsigned char *)"\x13\x03")
#define TLS13_AES_128_CCM_SHA256_BYTES ((const unsigned char *)"\x13\x04")
#define TLS13_AES_128_CCM_8_SHA256_BYTES ((const unsigned char *)"\x13\05")
#define TLS13_SHA256_SHA256_BYTES ((const unsigned char *)"\xC0\xB4")
#define TLS13_SHA384_SHA384_BYTES ((const unsigned char *)"\xC0\xB5")

int create_ssl_ctx_pair(OSSL_LIB_CTX *libctx, const SSL_METHOD *sm,
const SSL_METHOD *cm, int min_proto_version,
Expand Down
10 changes: 8 additions & 2 deletions test/quicapitest.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -336,7 +336,11 @@ static int test_cipher_find(void)
{ TLS13_AES_256_GCM_SHA384_BYTES, 1 },
{ TLS13_CHACHA20_POLY1305_SHA256_BYTES, 1 },
{ TLS13_AES_128_CCM_SHA256_BYTES, 0 },
{ TLS13_AES_128_CCM_8_SHA256_BYTES, 0 }
{ TLS13_AES_128_CCM_8_SHA256_BYTES, 0 },
#if !defined(OPENSSL_NO_INTEGRITY_ONLY_CIPHER)
{ TLS13_SHA256_SHA256_BYTES, 0 },
{ TLS13_SHA384_SHA384_BYTES, 0 }
#endif
};
size_t i;
int testresult = 0;
Expand Down Expand Up @@ -581,7 +585,9 @@ static int test_quic_forbidden_apis_ctx(void)
#define NON_QUIC_CIPHERSUITES \
"TLS_AES_128_CCM_SHA256:" \
"TLS_AES_256_CCM_SHA384:" \
"TLS_AES_128_CCM_8_SHA256"
"TLS_AES_128_CCM_8_SHA256:" \
"TLS_SHA256_SHA256:" \
"TLS_SHA384_SHA384" \

/* Set TLSv1.3 ciphersuite list for the SSL_CTX. */
if (!TEST_true(SSL_CTX_set_ciphersuites(ctx,
Expand Down
55 changes: 42 additions & 13 deletions test/sslapitest.c
View file
Original file line number Diff line number Diff line change
Expand Up @@ -3841,7 +3841,11 @@ static const char *ciphersuites[] = {
"TLS_AES_256_GCM_SHA384",
"TLS_AES_128_CCM_SHA256",
#if !defined(OPENSSL_NO_CHACHA) && !defined(OPENSSL_NO_POLY1305)
"TLS_CHACHA20_POLY1305_SHA256"
"TLS_CHACHA20_POLY1305_SHA256",
#endif
#if !defined(OPENSSL_NO_INTEGRITY_ONLY_CIPHER)
"TLS_SHA256_SHA256",
"TLS_SHA384_SHA384"
#endif
};

Expand All @@ -3862,7 +3866,7 @@ static int early_data_skip_helper(int testtype, int cipher, int idx)
unsigned char buf[20];
size_t readbytes, written;

if (is_fips && cipher == 4)
if (is_fips && (cipher == 4 || cipher == 5 || cipher == 6))
return 1;

if (!TEST_true(create_ssl_ctx_pair(libctx, TLS_server_method(),
Expand All @@ -3871,7 +3875,7 @@ static int early_data_skip_helper(int testtype, int cipher, int idx)
&sctx, &cctx, cert, privkey)))
goto end;

if (cipher == 0) {
if (cipher == 0 || cipher == 5 || cipher == 6) {
SSL_CTX_set_security_level(sctx, 0);
SSL_CTX_set_security_level(cctx, 0);
}
Expand All @@ -3882,8 +3886,9 @@ static int early_data_skip_helper(int testtype, int cipher, int idx)

if (!TEST_true(setupearly_data_test(&cctx, &sctx, &clientssl,
&serverssl, &sess, idx,
cipher == 2 ? SHA384_DIGEST_LENGTH
: SHA256_DIGEST_LENGTH)))
cipher == 2 || cipher == 6
? SHA384_DIGEST_LENGTH
: SHA256_DIGEST_LENGTH)))
goto end;

if (testtype == 1 || testtype == 2) {
Expand Down Expand Up @@ -4334,12 +4339,14 @@ static int test_early_data_psk(int idx)
}

/*
* Test TLSv1.3 PSK can be used to send early_data with all 5 ciphersuites
* Test TLSv1.3 PSK can be used to send early_data with all 7 ciphersuites
* idx == 0: Test with TLS1_3_RFC_AES_128_GCM_SHA256
* idx == 1: Test with TLS1_3_RFC_AES_256_GCM_SHA384
* idx == 2: Test with TLS1_3_RFC_CHACHA20_POLY1305_SHA256,
* idx == 3: Test with TLS1_3_RFC_AES_128_CCM_SHA256
* idx == 4: Test with TLS1_3_RFC_AES_128_CCM_8_SHA256
* idx == 5: Test with TLS1_3_RFC_SHA256_SHA256
* idx == 6: Test with TLS1_3_RFC_SHA384_SHA384
*/
static int test_early_data_psk_with_all_ciphers(int idx)
{
Expand All @@ -4359,7 +4366,14 @@ static int test_early_data_psk_with_all_ciphers(int idx)
NULL,
# endif
TLS1_3_RFC_AES_128_CCM_SHA256,
TLS1_3_RFC_AES_128_CCM_8_SHA256
TLS1_3_RFC_AES_128_CCM_8_SHA256,
# if !defined(OPENSSL_NO_INTEGRITY_ONLY_CIPHER)
TLS1_3_RFC_SHA256_SHA256,
TLS1_3_RFC_SHA384_SHA384
#else
NULL,
NULL
#endif
};
const unsigned char *cipher_bytes[] = {
TLS13_AES_128_GCM_SHA256_BYTES,
Expand All @@ -4370,13 +4384,23 @@ static int test_early_data_psk_with_all_ciphers(int idx)
NULL,
# endif
TLS13_AES_128_CCM_SHA256_BYTES,
TLS13_AES_128_CCM_8_SHA256_BYTES
TLS13_AES_128_CCM_8_SHA256_BYTES,
# if !defined(OPENSSL_NO_INTEGRITY_ONLY_CIPHER)
TLS13_SHA256_SHA256_BYTES,
TLS13_SHA384_SHA384_BYTES
#else
NULL,
NULL
#endif
};

if (cipher_str[idx] == NULL)
return 1;
/* Skip ChaCha20Poly1305 as currently FIPS module does not support it */
if (idx == 2 && is_fips == 1)
/*
* Skip ChaCha20Poly1305 & TLS_SHA{256,384}_SHA{256,384} cipher as
* currently FIPS module does not support it.
*/
if ((idx == 2 || idx == 5 || idx == 6) && is_fips == 1)
return 1;

/* We always set this up with a final parameter of "2" for PSK */
Expand All @@ -4385,7 +4409,7 @@ static int test_early_data_psk_with_all_ciphers(int idx)
SHA384_DIGEST_LENGTH)))
goto end;

if (idx == 4) {
if (idx == 4 || idx == 5 || idx == 6) {
/* CCM8 ciphers are considered low security due to their short tag */
SSL_set_security_level(clientssl, 0);
SSL_set_security_level(serverssl, 0);
Expand Down Expand Up @@ -5232,7 +5256,12 @@ static int test_tls13_ciphersuite(int idx)
# endif
/* CCM8 ciphers are considered low security due to their short tag */
{ TLS1_3_RFC_AES_128_CCM_8_SHA256
":" TLS1_3_RFC_AES_128_CCM_SHA256, 1, 1 }
":" TLS1_3_RFC_AES_128_CCM_SHA256, 1, 1 },
# if !defined(OPENSSL_NO_INTEGRITY_ONLY_CIPHER)
/* Integrity-only cipher do not provide any confidentiality */
{ TLS1_3_RFC_SHA256_SHA256
":" TLS1_3_RFC_SHA384_SHA384, 0, 1 }
# endif
};
const char *t13_cipher = NULL;
const char *t12_cipher = NULL;
Expand Down Expand Up @@ -11552,7 +11581,7 @@ int setup_tests(void)
ADD_ALL_TESTS(test_early_data_skip_abort, OSSL_NELEM(ciphersuites) * 3);
ADD_ALL_TESTS(test_early_data_not_sent, 3);
ADD_ALL_TESTS(test_early_data_psk, 8);
ADD_ALL_TESTS(test_early_data_psk_with_all_ciphers, 5);
ADD_ALL_TESTS(test_early_data_psk_with_all_ciphers, 7);
ADD_ALL_TESTS(test_early_data_not_expected, 3);
# ifndef OPENSSL_NO_TLS1_2
ADD_ALL_TESTS(test_early_data_tls1_2, 3);
Expand Down

0 comments on commit ad6ce15

Please sign in to comment.